That's a good question, and I just now figured it out: the print_form_header() function is adding do on the url *and* as a hidden field, and the hidden field value is run through htmlspecialchars(), so the '&' gets encoded and it looks like one field. I guess this hidden POSTed field is overriding the GET value for do on the url. So maybe your existing code would work if you used $_GET for do and u and $_REQUEST for the rest of the values.
Quote:
I added "echo $vbulletin->GPC['userid'];" right after I made the form and it gave me "Array['userid'] ".
^Not sure if that matters. It works if I put I call "$username" ($username = $vbulletin->GPC['userid']
I think you need {$vbulletin->GPC['userid']} to make it so you don't get "Array['userid'] ".